A.7.7
Clear desk and clear screen
Physical controlsCheckpoints 6Evidence 7Cases 6
Control objective
This control requires that sensitive documents and storage media not be left unattended on desks, cabinets, or output trays, and that screens be locked or otherwise protected when a workstation is unattended, so as to reduce the risk of unauthorized viewing, copying, theft, or alteration. Because offices are shared by many people including visitors, cleaning and maintenance staff, and colleagues from other teams, unattended paperwork or a logged-in screen becomes a path for information leakage without any intrusion. The organization should define clear desk and clear screen rules commensurate with the sensitivity of information and media, and embed them as everyday working habits.
Key checkpoints
- Are clear desk rules defined so that sensitive documents, printouts, and storage media are stored in locked drawers/cabinets/containers rather than left on desks?
- Is automatic screen locking applied after a period of inactivity, and are users required to lock manually (for example, a screen-lock shortcut) when leaving their workstation?
- Are controls such as secure printing (release after user authentication) applied so that printouts are not left on shared printers, multifunction devices, or fax machines?
- Are whiteboards, sticky notes, and monitor attachments managed so that account credentials or sensitive information is not exposed?
- Are storage and disposal methods applied differentially by the sensitivity (classification) of information and media, and do the rules also cover meeting rooms, shared spaces, and remote-work environments?
- Are compliance checks (such as walk-through inspections) and awareness activities carried out for clear desk and clear screen practices?
Implementation guidance
- Establish a clear desk and clear screen policy that specifies the covered information/media, storage methods, actions when leaving a workstation, and consequences of violations, and communicate it to staff and external personnel.
- Provide storage means such as lockable drawers, cabinets, and safes according to the sensitivity classification of information and media, and apply no-unattended rules differentially by level.
- Enforce actual locking after a defined idle period and authentication on resume. A screensaver alone is not a lock; train users to lock manually when leaving the workstation.
- Apply pull printing (release after user authentication) or immediate collection procedures on shared output devices, and manage output trays so that documents do not accumulate.
- Establish procedures to clear documents and media from desks at end of day and during extended absence, and to dispose of unnecessary documents by secure means such as shredding.
- Apply the same rules to remote/home working and shared-seating (hot-desk) environments, and provide guidance on document storage and screen-exposure prevention in personal spaces.
- Verify compliance through periodic walk-through or self-inspections, and feed violations into awareness training and improvement.
Evidence
- Clear desk and clear screen policy/procedure document
- Screen automatic-lock policy settings/configuration values (idle-time basis)
- Secure printing (release after user authentication) configuration and operating records
- Status of provided storage means such as lockable drawers/cabinets/safes
- Walk-through/self-inspection checklists and inspection results
- Awareness training materials and violation-response records
- Document disposal (shredding, and so on) procedure and disposal records
Nonconformity examples
- Sensitive contracts or printouts containing personal data are left on desks even after staff have gone home.
- Automatic screen locking is not configured, or the idle time is set excessively long, so screens are exposed while workstations are unattended.
- Printouts containing personal data accumulate uncollected on a shared multifunction device for extended periods.
- Sticky notes with account passwords are attached to monitors or partitions.
- No lockable storage is provided, so sensitive documents are kept in open desk drawers.
- No clear desk and clear screen rules exist for remote/shared-seating environments, so documents and screens are exposed without control.